﻿
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<!-- saved from url=(0014)about:internet -->
<html xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:mssdk="winsdk" xmlns:script="urn:script" xmlns:build="urn:build" xmlns:MSHelp="http://msdn.microsoft.com/mshelp">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8"/>
<meta name="Description" content="The !reg extension displays and searches through registry data."/>
<meta name="MSHAttr" content="PreferredSiteName:MSDN"/>
<meta name="MSHAttr" content="PreferredLib:/library/windows/hardware"/>
<title>!reg</title>

<meta name="MS-HAID" content="r29_exts_kernel_Q_a0d5a48c-9f77-4373-8153-d3dd26dd8337.xml"/>


<link rel="STYLESHEET" type="text/css" HREF="../common/backsdk4.css"/>





<style>
html,div { margin: 0; padding: 0;}

body {
	padding: 0px;
	margin: 0px;
	overflow: auto;
	height: 100%;
}

#winchm_template_button{
	float: right;
	width: 93px;
	top: 7px;
	position: relative;
	text-align: right;
	right: 5px;
	height: auto;
}

#winchm_template_top{
	padding: 0px;
	margin: 0px;
	border-bottom: 1px solid #9B9B9B;
	background-color: #B1CEFE;
}

#winchm_template_navigation{
	margin: 0px;
	padding-top: 7px;
	padding-left: 7px;
	padding-bottom: 3px;
	padding-right: 0px;
	font-size: 8.5pt;
	font-family: Arial, Helvetica, sans-serif;
	font-weight: normal;
	color: #585858;
}

#winchm_template_title{
	margin: 0px;
	padding-top: 4px;
	padding-left: 7px;
	padding-bottom: 7px;
	padding-right: 0px;
	font-size: 18px; 
	font-family: Verdana, Geneva, sans-serif;
	color: #363636;
}

#winchm_template_content{
	margin-top: 20px;
	margin-left: 15px;
	margin-bottom: 20px;
	margin-right: 15px;
	width: auto  !important;
	width: 100%;
}

#winchm_template_footer{
	border-width: 1px;
	border-color: #B1CEFE;
	border-top-style: solid;
	margin-top: 15px;
	margin-left: 15px;
	margin-bottom: 20px;
	margin-right: 15px;
	padding-top: 7px;
	padding-left: 0px;
	padding-bottom: 0px;
	padding-right: 0px;
	font-family: arial, helvetica, sans-serif;
	font-size: 8.5pt;
	color: #696969;
	width: auto;
	text-align: left;
}


#winchm_template_container{
	margin: 0px;
	padding: 0px;
	position: static;
	padding-bottom: 3px;
	overflow: auto;
	background-color: #FFFFFF;
}


@media print
{
#winchm_template_container{
	position: static;	
	margin: 0px;
	padding: 5px;
	
	width: auto;
	height: auto;
	overflow: auto;
}
#winchm_template_button{
visibility:hidden;
}
}

#winchm_template_navigation A:link	{text-decoration: none; color:#004080}
#winchm_template_navigation A:visited  {text-decoration: none; color: #004080}
#winchm_template_navigation A:active {text-decoration: none; color: #004080 }
#winchm_template_navigation A:hover {text-decoration: none;color: #0080FF}

A:link	{text-decoration: underline; color:#0033CC}
A:visited  {text-decoration: underline; color: #0033CC}
A:active {text-decoration: underline; color: #0033CC }
A:hover {text-decoration: underline;color: #FF0000;}
</style>
<script type="text/javascript">
function isMobile(){
Agent = window.navigator.userAgent;
if (Agent.indexOf("iPhone")>=1 || Agent.indexOf("iPad")>=1 || Agent.indexOf("iPod")>=1 || Agent.indexOf("Android")>=1){
return true;
}else{
return false;	
}

}
function d_onresize(){
if (window.navigator.userAgent.indexOf("MSIE")>=1){
document.getElementById('winchm_template_container').style.pixelWidth = document.body.offsetWidth - 3;
document.getElementById('winchm_template_container').style.pixelHeight = document.body.offsetHeight - document.getElementById('winchm_template_top').offsetHeight - 4;
}
document.getElementById('winchm_template_container').style.top = document.getElementById('winchm_template_top').offsetHeight + 'px';
}

function d_onbeforeprint(){
document.getElementById('winchm_template_container').style.width = 'auto';
document.getElementById('winchm_template_container').style.height = 'auto';
}

function d_onafterprint(){
d_onresize();
}

if(!isMobile()){

window.onload = d_onresize;
window.onresize = d_onresize;
window.onbeforeprint = d_onbeforeprint;
window.onafterprint = d_onafterprint;

document.write("<style>\n");
document.write("body {overflow: hidden;}\n");
document.write("#winchm_template_container {position: absolute;overflow: auto;top : 0px;right: 0px;bottom: 0px;left: 0px;}\n");
document.write("</style>\n");
}

</script>
</head>
<body><script language="JavaScript" type="text/JavaScript">
function syn(){
if(parent.nav.tree){
 if(parent.nav.tree.loaded){
  parent.nav.tree.selectNode(2426);
 }else{
  setTimeout("syn()",500);
}
  }else{
  setTimeout("syn()",500);
  }}
if(parent!=self){
  setTimeout("syn()",100);
}else{
  parent.location.href = "../../index.htm?page=debugger/_reg.htm";
}
originalOnload = window.onload;
if(originalOnload==null){
window.onload = function(){parent.contentLoaded = true;};
}else{
window.onload = function(){originalOnload();parent.contentLoaded = true;};
}
</script> 


<div id="winchm_template_top">
	<div id="winchm_template_button"><A href="_ready.htm" title="Previous topic"><img id="winchm_template_prev" alt="Previous topic" src="../template2/btn_prev_n.gif" border="0"></a><A href="_regkcb.htm" title="Next topic"><img id="winchm_template_next" alt="Next topic" src="../template2/btn_next_n.gif" border="0"></a></div>
	<div id="winchm_template_navigation">Help &gt; 
<A href="introduction6.htm">Debugging Tools for Windows (WinDbg, KD, CDB, NTSD)</A> &gt; <A href="debugger_reference.htm">Debugger Reference</A> &gt; <A href="debugger_commands.htm">Debugger Commands</A> &gt; <A href="kernel_mode_extensions.htm">Kernel-Mode Extension Commands</A> &gt; </div>
	<div id="winchm_template_title">!reg</div>
</div>
<div id="winchm_template_container">
	<div id="winchm_template_content"><div id="mainSection"><p>The <b>!reg</b> extension displays and searches through registry data.</p>
<pre class="syntax"><b>!reg </b>{<b>querykey</b>|<b>q</b>}<b> </b><i>FullKeyPath</i>
<b>!reg keyinfo </b><i>HiveAddress</i><b> </b><i>KeyNodeAddress</i>
<b>!reg kcb </b><i>Address</i> 
<b>!reg knode </b><i>Address</i> 
<b>!reg kbody </b><i>Address</i> 
<b>!reg kvalue </b><i>Address</i> 
<b>!reg valuelist </b><i>HiveAddress</i><b> </b><i>KeyNodeAddress</i> 
<b>!reg subkeylist </b><i>HiveAddress</i><b> </b><i>KeyNodeAddress</i>  
<b>!reg baseblock </b><i>HiveAddress</i> 
<b>!reg seccache </b><i>HiveAddress</i> 
<b>!reg hashindex </b>[<i>HiveAddress</i>]<i>HashKey</i>
<b>!reg openkeys </b>{<i>HiveAddress</i>|<b>0</b>}
<b>!reg openhandles </b>{<i>HiveAddress</i>|<b>0</b>} 
<b>!reg findkcb </b><i>FullKeyPath</i> 
<b>!reg hivelist</b> 
<b>!reg viewlist </b><i>HiveAddress</i> 
<b>!reg freebins </b><i>HiveAddress</i> 
<b>!reg freecells </b><i>BinAddress</i> 
<b>!reg dirtyvector </b><i>HiveAddress</i> 
<b>!reg cellindex </b><i>HiveAddress</i><b> </b><i>Index</i>
<b>!reg freehints </b><i>HiveAddress</i><b> </b><i>Storage</i><b> </b><i>Display</i> 
<b>!reg translist </b>{<i>RmAddress</i>|<b>0</b>}
<b>!reg uowlist </b><i>TransactionAddress</i>
<b>!reg locktable </b><i>KcbAddress</i> <i>ThreadAddress</i>
<b>!reg convkey </b><i>KeyPath</i>
<b>!reg postblocklist</b>
<b>!reg notifylist</b>
<b>!reg ixlock </b><i>LockAddress</i>
<b>!reg dumppool </b>[<b>s</b>|<b>r</b>]</pre>
<h2><a id="ddk__reg_dbg"></a><a id="DDK__REG_DBG"></a>Parameters</h2>
<p></p>
<dl>
<dt><a id="_______querykeyq_FullKeyPath______"></a><a id="_______querykeyq_fullkeypath______"></a><a id="_______QUERYKEYQ_FULLKEYPATH______"></a>       {<b>querykey</b>|<b>q</b>}<b> </b><i>FullKeyPath</i>      </dt>
<dd>
<p>Displays subkeys and values of a key if the key is cached. <i>FullKeyPath</i> specifies the full key path.</p>
</dd>
<dt><a id="_____________keyinfo_HiveAddress_KeyNodeAddress"></a><a id="_____________keyinfo_hiveaddress_keynodeaddress"></a><a id="_____________KEYINFO_HIVEADDRESS_KEYNODEADDRESS"></a>             <b>keyinfo </b><i>HiveAddress</i><b> </b><i>KeyNodeAddress</i></dt>
<dd>
<p>Displays subkeys and values of a key node. <i>HiveAddress</i> specifies the address of the hive. <i>KeyNodeAddress</i> specifies the address of the key node.</p>
</dd>
<dt><a id="_______kcb_______Address______"></a><a id="_______kcb_______address______"></a><a id="_______KCB_______ADDRESS______"></a>       <b>kcb</b><b>       </b><i>Address</i>      </dt>
<dd>
<p>Displays a registry key control block. <i>Address</i> specifies the address of the key control block.   
		</p>
</dd>
<dt><a id="_______knode_______Address______"></a><a id="_______knode_______address______"></a><a id="_______KNODE_______ADDRESS______"></a>       <b>knode</b><b>       </b><i>Address</i>      </dt>
<dd>
<p>Displays a registry key node structure. <i>Address</i> specifies the address of the key node. 
		</p>
</dd>
<dt><a id="_______kbody_______Address______"></a><a id="_______kbody_______address______"></a><a id="_______KBODY_______ADDRESS______"></a>       <b>kbody</b><b>       </b><i>Address</i>      </dt>
<dd>
<p>Displays a registry key body structure. <i>Address</i> specifies the address of the key body. (Registry key bodies are the actual objects associated with handles.)</p>
</dd>
<dt><a id="_______kvalue_______Address______"></a><a id="_______kvalue_______address______"></a><a id="_______KVALUE_______ADDRESS______"></a>       <b>kvalue</b><b>       </b><i>Address</i>      </dt>
<dd>
<p>Displays a registry key value structure. <i>Address</i> specifies the address of the value.</p>
</dd>
<dt><a id="_______valuelist_______HiveAddress_KeyNodeAddress______"></a><a id="_______valuelist_______hiveaddress_keynodeaddress______"></a><a id="_______VALUELIST_______HIVEADDRESS_KEYNODEADDRESS______"></a>       <b>valuelist</b><b>       </b><i>HiveAddress</i><b> </b><i>KeyNodeAddress</i>      </dt>
<dd>
<p>Displays a list of the values in the specified key node. <i>HiveAddress</i> specifies the address of the hive. <i>KeyNodeAddress</i> specifies the address of the key node.</p>
</dd>
<dt><a id="subkeylist_______HiveAddress_KeyNodeAddress______"></a><a id="subkeylist_______hiveaddress_keynodeaddress______"></a><a id="SUBKEYLIST_______HIVEADDRESS_KEYNODEADDRESS______"></a><b>subkeylist</b><b>       </b><i>HiveAddress</i><b> </b><i>KeyNodeAddress</i>      </dt>
<dd>
<p>Displays a list of the subkeys of the specified key node. <i>HiveAddress</i> specifies the address of the hive. <i>KeyNodeAddress</i> specifies the address of the key node.</p>
</dd>
<dt><a id="_______baseblock_______HiveAddress______"></a><a id="_______baseblock_______hiveaddress______"></a><a id="_______BASEBLOCK_______HIVEADDRESS______"></a>       <b>baseblock</b><b>       </b><i>HiveAddress</i>      </dt>
<dd>
<p>Displays the base block for a hive (also known as the <i>hive header</i>). <i>HiveAddress</i> specifies the address of the hive.</p>
</dd>
<dt><a id="_______seccache_______HiveAddress______"></a><a id="_______seccache_______hiveaddress______"></a><a id="_______SECCACHE_______HIVEADDRESS______"></a>       <b>seccache</b><b>       </b><i>HiveAddress</i>      </dt>
<dd>
<p>Displays the security cache for a hive. <i>HiveAddress</i> specifies the address of the hive.</p>
</dd>
<dt><a id="_______hashindex_______HiveAddress_HashKey______"></a><a id="_______hashindex_______hiveaddress_hashkey______"></a><a id="_______HASHINDEX_______HIVEADDRESS_HASHKEY______"></a>       <b>hashindex</b><b>       </b>[<i>HiveAddress</i>]<b> </b><i>HashKey</i>      </dt>
<dd>
<p>Computes the hash index entry for a hash key. <i>HiveAddress</i> specifies the address of the hive. <i>HashKey</i> specifies the key.</p>
<div class="alert"><b>Note</b>  <i>HiveAddress</i> is required if the target computer is running Windows 7 or later.</div>
<div> </div>
</dd>
<dt><a id="_______openkeys_HiveAddress0_"></a><a id="_______openkeys_hiveaddress0_"></a><a id="_______OPENKEYS_HIVEADDRESS0_"></a>       <b>openkeys </b>{<i>HiveAddress</i>|<b>0</b>} </dt>
<dd>
<p>Displays all open keys in a hive. <i>HiveAddress</i> specifies the address of the hive. If zero is used instead, the entire registry hash table is displayed; this table contains all open keys in the registry. 
		</p>
</dd>
<dt><a id="_______findkcb_______FullKeyPath______"></a><a id="_______findkcb_______fullkeypath______"></a><a id="_______FINDKCB_______FULLKEYPATH______"></a>       <b>findkcb</b><b>       </b><i>FullKeyPath</i>      </dt>
<dd>
<p>Displays the registry key control block corresponding to a registry path. <i>FullKeyPath</i> specifies the full key path; this path must be present in the hash table.</p>
</dd>
<dt><a id="_______hivelist______"></a><a id="_______HIVELIST______"></a>       <b>hivelist</b>      </dt>
<dd>
<p>Displays a list of all hives in the system, along with detailed information about each hive.</p>
</dd>
<dt><a id="_______viewlist_______HiveAddress______"></a><a id="_______viewlist_______hiveaddress______"></a><a id="_______VIEWLIST_______HIVEADDRESS______"></a>       <b>viewlist</b><b>       </b><i>HiveAddress</i>      </dt>
<dd>
<p>Displays all pinned and mapped views for a hive, with detailed information for each view. <i>HiveAddress</i> specifies the address of the hive.</p>
</dd>
<dt><a id="_______freebins_______HiveAddress______"></a><a id="_______freebins_______hiveaddress______"></a><a id="_______FREEBINS_______HIVEADDRESS______"></a>       <b>freebins</b><b>       </b><i>HiveAddress</i>      </dt>
<dd>
<p>Displays all free bins for a hive, with detailed information for each bin. <i>HiveAddress</i> specifies the address of the hive.</p>
</dd>
<dt><a id="_______freecells_______BinAddress______"></a><a id="_______freecells_______binaddress______"></a><a id="_______FREECELLS_______BINADDRESS______"></a>       <b>freecells</b><b>       </b><i>BinAddress</i>      </dt>
<dd>
<p>Iterates through a bin and displays all free cells inside it. <i>BinAddress</i> specifies the address of the bin.</p>
</dd>
<dt><a id="_______dirtyvector_______HiveAddress______"></a><a id="_______dirtyvector_______hiveaddress______"></a><a id="_______DIRTYVECTOR_______HIVEADDRESS______"></a>       <b>dirtyvector</b><b>       </b><i>HiveAddress</i>      </dt>
<dd>
<p>Displays the dirty vector for a hive. <i>HiveAddress</i> specifies the address of the hive.</p>
</dd>
<dt><a id="_______cellindex_______HiveAddress_Index______"></a><a id="_______cellindex_______hiveaddress_index______"></a><a id="_______CELLINDEX_______HIVEADDRESS_INDEX______"></a>       <b>cellindex</b><b>       </b><i>HiveAddress</i><b> </b><i>Index</i>      </dt>
<dd>
<p>Displays the virtual address for a cell in a hive. <i>HiveAddress</i> specifies the address of the hive. <i>Index</i> specifies the cell index.</p>
</dd>
<dt><a id="_____________freehints_HiveAddress_Storage_Display"></a><a id="_____________freehints_hiveaddress_storage_display"></a><a id="_____________FREEHINTS_HIVEADDRESS_STORAGE_DISPLAY"></a>             <b>freehints </b><i>HiveAddress</i><b> </b><i>Storage</i><b> </b><i>Display</i></dt>
<dd>
<p>Displays free hint information.</p>
</dd>
<dt><a id="_____________translist_RmAddress0"></a><a id="_____________translist_rmaddress0"></a><a id="_____________TRANSLIST_RMADDRESS0"></a>             <b>translist </b>{<i>RmAddress</i>|<b>0</b>}</dt>
<dd>
<p>Displays the list of active transactions in an RM. <i>RmAddress</i> specifies the address of the RM.</p>
</dd>
<dt><a id="_____________uowlist_TransactionAddress"></a><a id="_____________uowlist_transactionaddress"></a><a id="_____________UOWLIST_TRANSACTIONADDRESS"></a>             <b>uowlist</b> <i>TransactionAddress</i></dt>
<dd>
<p>Displays the list of UoWs attached to a transaction. <i>TransactionAddress</i> specifies the address of the transaction.</p>
</dd>
<dt><a id="_____________locktable_KcbAddress_ThreadAddress"></a><a id="_____________locktable_kcbaddress_threadaddress"></a><a id="_____________LOCKTABLE_KCBADDRESS_THREADADDRESS"></a>             <b>locktable </b><i>KcbAddress</i> <i>ThreadAddress</i></dt>
<dd>
<p>Displays relevant lock table content.</p>
</dd>
<dt><a id="_____________convkey_KeyPath"></a><a id="_____________convkey_keypath"></a><a id="_____________CONVKEY_KEYPATH"></a>             <b>convkey </b><i>KeyPath</i></dt>
<dd>
<p>Displays hash keys for a key path.</p>
</dd>
<dt><a id="_____________postblocklist"></a><a id="_____________POSTBLOCKLIST"></a>             <b>postblocklist</b></dt>
<dd>
<p>Displays the list of threads that have postblocks posted.</p>
</dd>
<dt><a id="_____________notifylist"></a><a id="_____________NOTIFYLIST"></a>             <b>notifylist</b></dt>
<dd>
<p>Displays the list of notify blocks in the system.</p>
</dd>
<dt><a id="_____________ixlock_LockAddress"></a><a id="_____________ixlock_lockaddress"></a><a id="_____________IXLOCK_LOCKADDRESS"></a>             <b>ixlock </b><i>LockAddress</i></dt>
<dd>
<p>Displays ownership of an intent lock. <i>LockAddress</i> specifies the address of the lock.</p>
</dd>
<dt><a id="_______dumppool_sr"></a><a id="_______DUMPPOOL_SR"></a>       <b>dumppool </b>[<b>s</b>|<b>r</b>]</dt>
<dd>
<p>Displays registry-allocated paged pool. If <b>s</b> is specified, the list of registry pages is saved to a temporary file. If <b>r</b> is specified, the registry page list is restored from the previously saved temporary file.</p>
</dd>
</dl>
<h3><a id="DLL"></a><a id="dll"></a>DLL</h3>
<p>
          Kdexts.dll
         </p>
<h3><a id="Additional_Information"></a><a id="additional_information"></a><a id="ADDITIONAL_INFORMATION"></a>Additional Information</h3>
<p>For information about the registry and its components, see <i>Microsoft Windows Internals</i> by Mark Russinovich and David Solomon. (This book may not be available in some languages and 

countries.)</p>
<h2>Remarks</h2>
<p>Here is an example. First use <b>!reg hivelist</b> to get a list of hive addresses.</p>
<pre class="syntax" xml:space="preserve"><code>00: kd&gt; !reg hivelist

-------------------------------------------------------------------------------------------------------------------------------------------------------
|     HiveAddr     |Stable Length|    Stable Map    |Volatile Length|    Volatile Map    |MappedViews|PinnedViews|U(Cnt)|     BaseBlock     | FileName 
-------------------------------------------------------------------------------------------------------------------------------------------------------
| fffff8a000014010 |       1000  | fffff8a0000140b0 |       1000    |  fffff8a000014328  |     0| fffff8a00001e000  | &lt;NONAME&gt;
| fffff8a000028010 |     a15000  | fffff8a00002e000 |      1a000    |  fffff8a000028328  |     0| fffff8a000029000  | SYSTEM
| fffff8a00004f010 |      14000  | fffff8a00004f0b0 |       c000    |  fffff8a00004f328  |     0| fffff8a000050000  | &lt;NONAME&gt;
| fffff8a000329010 |       6000  | fffff8a0003290b0 |          0    |  0000000000000000  |     0| fffff8a00032f000  | Device\HarddiskVolume1\Boot\BCD
| fffff8a0002f2010 |    4255000  | fffff8a0006fa000 |       6000    |  fffff8a0002f2328  |     0| fffff8a00036c000  | emRoot\System32\Config\SOFTWARE
| fffff8a000df0010 |      f7000  | fffff8a000df00b0 |       1000    |  fffff8a000df0328  |     0| fffff8a000df1000  | temRoot\System32\Config\DEFAULT
| fffff8a0010f8010 |       9000  | fffff8a0010f80b0 |       1000    |  fffff8a0010f8328  |     0| fffff8a0010f9000  | emRoot\System32\Config\SECURITY
| fffff8a001158010 |       7000  | fffff8a0011580b0 |          0    |  0000000000000000  |     0| fffff8a001159000  | \SystemRoot\System32\Config\SAM
| fffff8a00124b010 |      24000  | fffff8a00124b0b0 |          0    |  0000000000000000  |     0| fffff8a00124c000  | files\NetworkService\NTUSER.DAT
| fffff8a0012df220 |      b7000  | fffff8a0012df2c0 |          0    |  0000000000000000  |     0| fffff8a0012e6000  | \SystemRoot\System32\Config\BBI
| fffff8a001312220 |      26000  | fffff8a0013122c0 |          0    |  0000000000000000  |     0| fffff8a00117e000  | rofiles\LocalService\NTUSER.DAT
| fffff8a001928010 |      64000  | fffff8a0019280b0 |       3000    |  fffff8a001928328  |     0| fffff8a00192b000  | User.MYTESTCOMPUTER2\ntuser.dat
| fffff8a001b9b010 |     203000  | fffff8a001bc4000 |          0    |  0000000000000000  |     0| fffff8a001b9c000  | \Microsoft\Windows\UsrClass.dat
| fffff8a001dc0010 |      30000  | fffff8a001dc00b0 |          0    |  0000000000000000  |     0| fffff8a001dc2000  | Volume Information\Syscache.hve
| fffff8a0022dc010 |     175000  | fffff8a0022dc0b0 |          0    |  0000000000000000  |     0| fffff8a0022dd000  | \AppCompat\Programs\Amcache.hve
-------------------------------------------------------------------------------------------------------------------------------------------------------
</code></pre>
<p>Use the third hive address in the preceding output (fffff8a00004f010) as an argument to <b>!reg openkeys</b>.</p>
<pre class="syntax" xml:space="preserve"><code>0: kd&gt; !reg openkeys fffff8a00004f010

Hive: \REGISTRY\MACHINE\HARDWARE
===========================================================================================
Index e9: 	 3069276d kcb=fffff8a00007eb98 cell=00000220 f=00200000 \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM
Index 101: 	 292eea1f kcb=fffff8a00007ecc0 cell=000003b8 f=00200000 \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MULTIFUNCTIONADAPTER
Index 140: 	 d927b0d4 kcb=fffff8a00007ea70 cell=000001a8 f=00200000 \REGISTRY\MACHINE\HARDWARE\DESCRIPTION
Index 160: 	 96d26a30 kcb=fffff8a00007e6f8 cell=00000020 f=002c0000 \REGISTRY\MACHINE\HARDWARE

0x4 keys found
===========================================================================================
</code></pre>
<p>Use the first full key path in the preceding output (\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM) as an argument to <b>!reg querykey</b>.</p>
<pre class="syntax" xml:space="preserve"><code>0: kd&gt; !reg querykey \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM

Found KCB = fffff8a00007eb98 :: \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM

Hive         fffff8a00004f010
KeyNode      fffff8a000054224

[SubKeyAddr]         [SubKeyName]
fffff8a000060244     CentralProcessor
fffff8a00006042c     FloatingPointProcessor
fffff8a0000543bc     MultifunctionAdapter

[SubKeyAddr]         [VolatileSubKeyName]
fffff8a000338d8c     BIOS
fffff8a0002a2e4c     VideoAdapterBusses

 Use '!reg keyinfo fffff8a00004f010 &lt;SubKeyAddr&gt;' to dump the subkey details

[ValueType]         [ValueName]                   [ValueData]
REG_BINARY          Component Information         0x542AC - 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
REG_SZ              Identifier                    AT/AT COMPATIBLE
REG_FULL_RESOURCE_DESCRIPTORConfiguration Data            ff ff ff ff ff ff ff ff 00 00 00 00 02 00 00 00 05 00 00 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 ff 03 00 00 3f 00 fe 00 02 00 81 00 fe 03 00 00 3f 00 fe 00 02 00 05 00 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 00 00 00 04 00 
REG_SZ              SystemBiosDate                07/18/07
REG_MULTI_SZ        SystemBiosVersion             HPQOEM - 20070718\0\0
REG_SZ              VideoBiosDate                 03/23/20
REG_MULTI_SZ        VideoBiosVersion              Hardware Version 0.0\0\0</code></pre>
<p>Here is another example:</p>
<pre class="syntax" xml:space="preserve"><code>kd&gt; !reg hivelist

-----------------------------------------------------------------------------------------------------------------------------
| HiveAddr |Stable Length|Stable Map|Volatile Length|Volatile Map|MappedViews|PinnedViews|U(Cnt)| BaseBlock | FileName 
-----------------------------------------------------------------------------------------------------------------------------
| e16e7428 |       2000  | e16e7484 |          0    |  00000000  |        1  |        0  |     0| e101f000  | \Microsoft\Windows\UsrClass.dat
| e1705a78 |      77000  | e1705ad4 |       1000    |  e1705bb0  |       30  |        0  |     0| e101c000  | ttings\Administrator\ntuser.dat
| e13d4b88 |     814000  | e146a000 |       1000    |  e13d4cc0  |      255  |        0  |     0| e1460000  | emRoot\System32\Config\SOFTWARE
| e13ad008 |      23000  | e13ad064 |       1000    |  e13ad140  |        9  |        0  |     0| e145e000  | temRoot\System32\Config\DEFAULT
| e13b3b88 |       a000  | e13b3be4 |       1000    |  e13b3cc0  |        3  |        0  |     0| e145d000  | emRoot\System32\Config\SECURITY
| e142d008 |       5000  | e142d064 |          0    |  00000000  |        2  |        0  |     0| e145f000  | &lt;UNKNOWN&gt;
| e11e3628 |       4000  | e11e3684 |       3000    |  e11e3760  |        0  |        0  |     0| e11e4000  | &lt;NONAME&gt;
| e10168a8 |     1c1000  | e1016904 |      15000    |  e10169e0  |       66  |        0  |     0| e1017000  | SYSTEM
| e10072c8 |       1000  | e1007324 |          0    |  00000000  |        0  |        0  |     0| e1010000  | &lt;NONAME&gt;
-----------------------------------------------------------------------------------------------------------------------------

kd&gt; !reg hashindex e16e7428

CmpCacheTable = e100a000

Hash Index[e16e7428] : 5ac
Hash Entry[e16e7428] : e100b6b0

kd&gt; !reg openkeys e16e7428

Index 68:  7bab7683 kcb=e13314f8 cell=00000740 f=00200004 \REGISTRY\USER\S-1-5-21-1715567821-413027322-527237240-500_Classes\CLSID
Index 7a1:  48a30288 kcb=e13a3738 cell=00000020 f=002c0004 \REGISTRY\USER\S-1-5-21-1715567821-413027322-527237240-500_Classes</code></pre>
<p>To display formatted registry key information, use the <a href="#Bookmark2476"><b>!dreg</b></a> extension instead.</p></div></div>	
	<div id="winchm_template_footer">Copyright &copy; 2019. All rights 
reserved. (To change the copyright info, just edit it in template.)</div>
</div>

</body>
</html>
